mirror of https://github.com/openai/codex.git synced 2026-11-13 21:30:47 +00:00

Files

T

sayan-oai 6fcfa75a9f Preserve MCP registration scope across client operations (#61257 )

## Why

MCP servers registered under the same name in different environments need distinct inventory, routing, and status reporting.

## What changed

- Keep MCP inventory and runtime status keyed by registration scope so same-named servers remain separate.
- Add optional `environmentId` selectors for status lookup, tool calls, resource reads, and OAuth login. Omitting the selector preserves existing name-only routing.
- Carry environment identity through startup notifications, elicitation requests, and tool-call history, and display it in the TUI.
- Support `/mcp login <name> --environment <id>` and update generated protocol schemas and SDK types.

## Testing

Add integration coverage for two environments with identically named MCP servers, tools, and resource URIs. Verify separate inventory, explicit environment routing, legacy routing when the selector is omitted, and errors for unknown environments. Update protocol and TUI tests for environment identity.

GitOrigin-RevId: 074a3db10549438cb6aff33eb7bed10791adae4d

2026-11-13 04:51:06 +00:00

src

Preserve MCP registration scope across client operations (#61257 )

2026-11-13 04:51:06 +00:00

BUILD.bazel

Expose a verified sandbox launcher to local MCP servers (#52182 )

2026-10-08 17:25:09 +00:00

Cargo.toml

Use runtime authentication for OpenAI MCP and app requests (#59749 )

2026-11-05 22:03:29 +00:00

README.md

Separate MCP sandbox policy from launcher metadata (#53709 )

2026-10-13 16:23:44 +00:00

README.md

Codex MCP runtime

This crate manages Codex's MCP connections, tool calls, and their captured authority.

Sandbox request metadata

An MCP server advertises the experimental codex/sandbox-state capability to receive sandbox metadata on tool calls. The deprecated capability name codex/sandbox-state-meta opts into the same contract during migration.

Codex supplies these entries in the request's _meta object:

Key	Value
`codex/sandbox-state`	Opaque policy to pass to `codex sandbox --sandbox-state-json`.
`codex/sandbox-state-meta`	An identical copy of that policy under the deprecated name.
`codex/sandbox-launcher`	When available, an object with an absolute `codexExecutable` path to a verified full Codex CLI on the MCP server's host.

Use the launcher path to invoke sandbox --sandbox-state-json with the entire state value serialized as one argument, followed by -- and the command to run. The state contains neither launcher discovery data nor deprecation messages. Preserve unknown policy fields by forwarding the original value rather than deserializing and reconstructing it. The two state names are aliases, not separate policies; new consumers should prefer codex/sandbox-state.

Launcher metadata is currently available only for local stdio servers. An HTTP endpoint, including loopback, or a remote executor does not establish a shared filesystem with the harness. Codex omits the launcher when its path is unknown, not representable as UTF-8, or fails the cached capability probe. Absence does not authorize a PATH search or unsandboxed fallback. Servers that require a launcher must fail closed or require an explicit operator opt-out.

The state and launcher describe the issuing call. Retain both when starting a long-lived subprocess or caching policy-bound results; reject changed authority before reusing them. Tool arguments supplied by the model are not authority. See sandbox_metadata.rs for the wire types and binding.rs for execution-environment selection.